Token approvals: the permission that drains wallets
Most self-custody losses are not break-ins. They are permissions the owner granted, on a page that looked right, and never took back.
Before an app can move a token out of your wallet, you have to give it permission. That permission is a separate transaction from the one you actually wanted, which is why it is easy to click past, and it is the mechanism behind most of the money lost in self-custody.
The important detail: an approval is not a one-time consent. By default it is unlimited in amount and permanent in duration. It keeps working long after you have stopped using the app, and it works whether or not the app is still under its original owners' control.
Why the default is unlimited
Approving an exact amount would mean a second transaction, and a second fee, for every trade. Apps request an unlimited allowance so that never happens. It is a genuine convenience, and it means the contract can withdraw that token from your wallet, in any quantity, at any point in the future.
For a contract that is honest and stays honest, nothing goes wrong. The risk is what happens later: an upgrade path, a compromised key, a team that sells the project, or a phishing page that persuades you to approve a contract that was never honest to begin with.
The three ways this goes wrong
- A signature you were tricked into. The page looked like the app you use. The approval went to a different contract. Nothing on screen was obviously wrong.
- A contract that was upgraded. You approved something safe; the address you approved now runs different code. Who is able to do that varies enormously between protocols — Uniswap cannot, and most others can.
- An old allowance you forgot. A bridge or exchange you used once in 2023, still holding an unlimited allowance on a token you now hold much more of.
How to see what you have already granted
Every chain's block explorer has a token-approval view, and several free revocation tools list every open allowance across chains from a read-only address — no signature needed to look. Most people find allowances they do not remember granting to apps they have not opened in years.
Revoking costs a transaction fee per approval and nothing else. It does not affect your holdings and does not stop you using the app again — you simply approve again next time.
The habits that prevent it
- Use a wallet that simulates transactions and shows you what you are signing in plain terms. Rabby does this by default and flags a contract you have never interacted with.
- Set a finite allowance when the wallet offers it. The extra fee is small and it caps your exposure at the amount you meant to trade.
- Separate balances. A wallet used for on-chain activity should not be the wallet holding your long-term position — see our hardware wallet rating for the devices that make that split practical.
- Review approvals whenever you stop using an app, and once a year regardless.
Approvals are not the only signature that matters
Newer permission schemes let you sign an off-chain message that grants an allowance without a transaction at all. That means no fee, no on-chain trace at the moment of signing, and a signature request that looks like an ordinary login prompt. Treat any signature request that mentions a token, a spender or an amount as an approval, whatever the interface calls it.
An approval is not permission for this transaction. It is permission for every future one, until you take it back.
The short version
Assume every approval you have ever granted is still live, because it probably is. Check them with a free revocation tool, cancel the ones you no longer use, and switch to a wallet that tells you what a signature does before you give it.
Frequently asked questions
What is a token approval in crypto?+
It is a permission you grant to a smart contract allowing it to move a specific token out of your wallet. It is required before most swaps, deposits and bridges, and it is a separate transaction from the action you wanted. By default it is unlimited in amount and does not expire.
How do I revoke a token approval?+
Use your chain's block explorer approval view or a free revocation tool, which lists every open allowance for an address. Revoking costs one transaction fee per approval, does not touch your balance, and does not stop you using the app again later.
Are unlimited token approvals dangerous?+
They are safe while the contract is honest and stays under its original control, and dangerous the moment either stops being true — through an upgrade, a compromised key, or an approval you were tricked into granting. The exposure is the entire balance of that token, not the amount you traded.
How do wallet drainers work?+
Almost always by persuading you to sign a legitimate-looking approval or permit message on a page that imitates an app you use. No cryptography is broken; the owner grants the permission voluntarily. Wallets that simulate transactions and flag unfamiliar contracts are the most effective defence.
How this was reported
ChainWatch Daily is independent and reader-funded. Stories are written by named journalists and checked against primary sources before publishing. We disclose holdings, correct errors in the open, and never accept payment for coverage.
More like this
The seed phrase mistakes that cost people everything
Almost nobody loses a recovery phrase to a hacker. They lose it to a house move, a photograph, a fire, or a split so clever nobody could reassemble it.
Hardware wallet or software wallet: how to decide
The threshold is not an amount. It is whether you can read what you are being asked to sign — and that is a question about the device, not about you.
How to check an exchange is really holding your money
Proof of reserves is the only tool a customer has for verifying a balance exists. Most published proofs do not survive a careful read — here is what separates the real ones.